General
-
Target
source_prepared.exe
-
Size
44.4MB
-
Sample
240707-wp64fswdlp
-
MD5
02e067e9713b40ae7b7b394906572239
-
SHA1
464916393583bf5ab522712b8f4f1eb83b2a65d3
-
SHA256
dfa2b0fcae86dff38827813320aaa400b9e2a466684098728d4654ec850689b1
-
SHA512
243cef6214f3ee11db7da341f79463799526f17852698f11a5a61624771c7d8ade681090302df09d24db90161708a05d6d658a013a068b6f63141bc39b947c09
-
SSDEEP
786432:F9OAQE+r2dkg/IpG7VB8VPhqEszcY87WKEW8jMPOZTrgC:bhQRrSk8IpG7V+VPhqFE7WKEWEMGZTrJ
Behavioral task
behavioral1
Sample
source_prepared.exe
Resource
win10v2004-20240704-en
Malware Config
Targets
-
-
Target
source_prepared.exe
-
Size
44.4MB
-
MD5
02e067e9713b40ae7b7b394906572239
-
SHA1
464916393583bf5ab522712b8f4f1eb83b2a65d3
-
SHA256
dfa2b0fcae86dff38827813320aaa400b9e2a466684098728d4654ec850689b1
-
SHA512
243cef6214f3ee11db7da341f79463799526f17852698f11a5a61624771c7d8ade681090302df09d24db90161708a05d6d658a013a068b6f63141bc39b947c09
-
SSDEEP
786432:F9OAQE+r2dkg/IpG7VB8VPhqEszcY87WKEW8jMPOZTrgC:bhQRrSk8IpG7V+VPhqFE7WKEWEMGZTrJ
Score9/10-
Enumerates VirtualBox DLL files
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-